ui-proxy

Overview ¶

ui-proxy — Backend-for-Frontend for the agent-orca React UI.

Serves the pre-built React SPA (embedded at compile time from ./dist) and reverse-proxies all /api/* requests to the operator's UI API server. Every proxied request is authenticated using a Kubernetes projected ServiceAccount token (audience: agentorca/ui) mounted into the pod at runtime.

Browser requests require no authentication — access control is enforced at the network layer (NetworkPolicy + Ingress). OIDC/SAML can be added later as an Ingress annotation or a separate proxy in front of this pod.

Build:

cd ui && npm run build
cp -r ui/dist cmd/ui-proxy/dist/
go build ./cmd/ui-proxy

Note: go:embed ignores dotfiles, so cmd/ui-proxy/dist must contain at least one non-hidden file (for example index.html) even before copying the SPA build.

Flags:

--port           listening port (default 8080)
--operator-addr  upstream operator UI API (default http://localhost:8083)
--token-file     projected SA token path (default /var/run/secrets/agentorca/ui/token)